Help Center/ Cloud Firewall/ Best Practices/ Allowing Outbound Traffic from Cloud Resources Only to a Specified Domain Name
Updated on 2024-12-02 GMT+08:00
View PDF
Share

Allowing Outbound Traffic from Cloud Resources Only to a Specified Domain Name

Application Scenarios

To prevent sensitive data leakage or external attacks, you need to restrict the Internet domain names that can be accessed by cloud resources.

Use CFW to implement refined management and control on cloud resources and allow access traffic from all EIPs to ports 80 and 443 of a specified domain name. (Wildcard domain name *.example.com is used as an example).

Configuring CFW to Allow Cloud Resources to Access a Specified Domain Name

  1. Purchase the CFW standard or professional edition. For details, see Purchasing CFW.
  2. In the navigation pane on the left, click and choose Security & Compliance > Cloud Firewall. The Dashboard page will be displayed.
  3. (Optional) Switch firewall instance: Select a firewall from the drop-down list in the upper left corner of the page.
  4. Enable protection for an EIP.

    1. In the navigation pane, choose Assets > EIPs. The EIPs page is displayed. The EIP information is automatically updated to the list.
    2. In the row of the EIP, click Enable Protection in the Operation column.

  5. Configure protection rules.

    1. In the navigation pane, choose Access Control > Access Policies.
    2. Click Add Rule. On the Add Rule page, configure protection information and set other parameters as needed.
      Configure the following protection rules:
      • One of the rule blocks all traffic, as shown in Figure 1. The priority is the lowest.
        • Direction: Outbound
        • Source: Any
        • Destination: Any
        • Service: Any
        • Application: Any
        • Protection Action: Block
        Figure 1 Blocking all traffic
      • The other rule allows the traffic to ports 80 and 443 of *.example.com, as shown in Figure 2. The priority is the highest.
        • Direction: Outbound
        • Source: Any
        • Destination: Select Domain name/domain group and then Application. Select Domain name from the drop-down list and enter *.example.com.
        • Service: TCP/1-65535/80 and TCP/1-65535/443
        • Application: HTTP and HTTPS
        • Action: Allow
        Figure 2 Allowing the access traffic to a domain name

  6. View the rule hits in access control logs.

    In the navigation pane, choose Log Audit > Log Query. Click the Access Control Logs tab.

    In the rows where Destination IP is a domain name matching example.com, the corresponding Action is Allow. For other traffic, the Action is Block.

References